Four prompts, one human. An AI agent did the research, the writing, the images, the publishing and the banners. A person on our team gave the brief, looked at the result before it went wider, and said yes. This post shows the prompts exactly as they were sent (translated from Czech) and every point where a human or a check stepped in.
The trigger: a customer question at 2 a.m.
On 21 October 2026 PHP shipped fixes for two critical vulnerabilities, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). A few hours later one of our customers wrote in: “I recently saw the news regarding a major PHP vulnerability. Could you please confirm if Super.so's infrastructure is affected?”
The honest answer was “no”, but a one-line reply doesn't scale when many customers ask the same thing. We wanted a public post that explains why, backed by facts we had actually checked. We did it with Claude Code connected to our tools through MCP: the Super MCP for the website, Notion for the content and Slack for the team.
Prompt 1: write the post
[The customer's message, pasted from our support alert] — Write a blog post about these vulnerabilities, list what we use, then send the link to #customer_support.
What the agent did in about 7 minutes:
- Researched the vulnerability and took the facts (CVE numbers, CVSS score, affected and fixed PHP versions) from the PHP Foundation and Qualys, not from memory.
- Checked our own stack by searching the code, the Docker images and the infrastructure setup for PHP files, Composer manifests and PHP images. It found none, and listed what we run instead: Next.js and Node.js on Vercel, NestJS on AWS, S3 and CloudFront, PostgreSQL, Redis, ClickHouse and Elasticsearch.
- Wrote and published the post as a new row in the Notion database behind our blog, then published it with the Super MCP.
- Verified it live: the page returned 200 and the text and call to action rendered. The first publish put the post at the wrong address (/content/… instead of /blog/…); the agent noticed, moved it and checked again.
- Posted the link to our support channel in Slack, so the team could answer the customer right away.
Result: PHP2Shell: Super is not affected.
Prompt 2: make the images
Check Notion tasks, we have a skill there for creating images, so use it for the cover and the preview.
We keep a skill (a reusable set of instructions) for blog images in our task board. The agent found it, followed its rules and generated a cover and a gallery preview in our black-and-white house style. It also checked that the new card would look different from its neighbours in the blog gallery, that the images contain no text, and that the header crops well on desktop and phone. Time: under 4 minutes, at about $0.07 in image generation.
Prompt 3: a banner, on one page first
Now add a suitable banner to this page [one of our case studies] that points to this article. Only for the next three days, then it switches itself off. After approval we'll put it on the whole site.
This is the first human checkpoint, written into the prompt itself: try it on one page, show me, then roll out. The agent wrote the banner as custom code through the Super MCP: a small floating pill at the bottom of the screen with a “Read →” button and a close button. Visitors who close it don't see it again, and it turns itself off on 25 October. It has a shorter text on phones and sits above the “Made with Super” badge.
Before reporting back, the agent took desktop and phone screenshots of the live page, clicked the link and the close button, and confirmed the banner did not appear on other pages.
The human check
A person on our team opened the case study, looked at the banner on desktop and phone, and read the post it linked to. Nothing was shown site-wide until then.
Prompt 4: roll it out
Spot on, that's it. Make it site-wide, plus the same on docs.super.so.
The agent changed one setting to show the banner on every page except the article itself, added the same banner to our documentation site, and checked both live again on desktop and phone. Because the banner is something any Super site might want, it also turned the code into a reusable recipe for Super MCP users.
The numbers
What | How much |
Prompts | 4 |
Agent working time | About 30 minutes |
Actions the agent took (searches, edits, publishes, screenshots) | About 190 |
Human checkpoints | 2: the brief, and the approval before going site-wide |
Output | A blog post, a cover and a preview image, a Slack message for support, a timed banner on two sites |
What “human-verified” means here
We don't think an AI should publish things about security on its own. Here is how we kept a person in charge without doing the work by hand:
- Facts come from sources, not from the model. Every number in the post links to the PHP Foundation or Qualys, and the claim “we don't run PHP” comes from searching our own code and infrastructure.
- The agent checks its own work live. It opens the published page, takes screenshots and clicks the buttons before it says “done”.
- Small first, then wide. Anything visitors see on every page is tried on one page and approved by a person first.
- Everything is easy to undo. The banner switches itself off, and the code is marked so anyone can find and remove it.
Try it on your own site
Everything above runs on tools you can use too. Connect Claude or another AI assistant to your Super site with the Super MCP, and you can publish pages, change custom code and check your live site in plain language.
